tofsee | 32b88643109ff71687d0afd291967db514f6ba60f0c8fb6ab08cca85c71bb0c5

Analysis

max time kernel
136s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0bd4b17197a237a6b892cb49969e8b2b.exe
Size 10.9MB
Sample231230-c2vreafge4
SHA256 32b88643109ff71687d0afd291967db514f6ba60f0c8fb6ab08cca85c71bb0c5
MD5 0bd4b17197a237a6b892cb49969e8b2b
SHA1 c3b747ef1d169a677c62b646382720507e884732
SHA512 5b431349caf2e0e106d969a356aa64127722562042ca2da313abe3b1852d36f2f7ba021e1112724bab718369ba649a7fb59b125ea6980fda419a6db71a09253a
SSDEEP 24576:pUqa71YB5DHlommmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmn:pF15
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\qlrgkqom = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2280	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\qlrgkqom\ImagePath = "C:\\Windows\\SysWOW64\\qlrgkqom\\ojyinski.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
768	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2584	ojyinski.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 768	2584	ojyinski.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2660	sc.exe
2796	sc.exe
2536	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2948	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	29
PID 1576 wrote to memory of 2948	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	29
PID 1576 wrote to memory of 2948	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	29
PID 1576 wrote to memory of 2948	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	29
PID 1576 wrote to memory of 2872	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	31
PID 1576 wrote to memory of 2872	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	31
PID 1576 wrote to memory of 2872	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	31
PID 1576 wrote to memory of 2872	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	31
PID 1576 wrote to memory of 2796	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	33
PID 1576 wrote to memory of 2796	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	33
PID 1576 wrote to memory of 2796	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	33
PID 1576 wrote to memory of 2796	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	33
PID 1576 wrote to memory of 2536	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	35
PID 1576 wrote to memory of 2536	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	35
PID 1576 wrote to memory of 2536	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	35
PID 1576 wrote to memory of 2536	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	35
PID 1576 wrote to memory of 2660	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	37
PID 1576 wrote to memory of 2660	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	37
PID 1576 wrote to memory of 2660	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	37
PID 1576 wrote to memory of 2660	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	37
PID 1576 wrote to memory of 2280	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	40
PID 1576 wrote to memory of 2280	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	40
PID 1576 wrote to memory of 2280	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	40
PID 1576 wrote to memory of 2280	1576	0bd4b17197a237a6b892cb49969e8b2b.exe	40
PID 2584 wrote to memory of 768	2584	ojyinski.exe	41
PID 2584 wrote to memory of 768	2584	ojyinski.exe	41
PID 2584 wrote to memory of 768	2584	ojyinski.exe	41
PID 2584 wrote to memory of 768	2584	ojyinski.exe	41
PID 2584 wrote to memory of 768	2584	ojyinski.exe	41
PID 2584 wrote to memory of 768	2584	ojyinski.exe	41

C:\Users\Admin\AppData\Local\Temp\0bd4b17197a237a6b892cb49969e8b2b.exe
"C:\Users\Admin\AppData\Local\Temp\0bd4b17197a237a6b892cb49969e8b2b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qlrgkqom\
  2⤵
  PID:2948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ojyinski.exe" C:\Windows\SysWOW64\qlrgkqom\
  2⤵
  PID:2872
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qlrgkqom binPath= "C:\Windows\SysWOW64\qlrgkqom\ojyinski.exe /d\"C:\Users\Admin\AppData\Local\Temp\0bd4b17197a237a6b892cb49969e8b2b.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2796
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qlrgkqom "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2536
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qlrgkqom
  2⤵
  - Launches sc.exe
  PID:2660
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2280

C:\Windows\SysWOW64\qlrgkqom\ojyinski.exe
C:\Windows\SysWOW64\qlrgkqom\ojyinski.exe /d"C:\Users\Admin\AppData\Local\Temp\0bd4b17197a237a6b892cb49969e8b2b.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ojyinski.exe

Path C:\Users\Admin\AppData\Local\Temp\ojyinski.exe
Size 893KB
SHA256 bf356e2c01da47e9b052dcec982784123ee558d635e59dd3a5273416f03ec867
MD5 6dd350d56a892e43451a8f3ed7d27c6f
SHA1 bece86f01472d25521827a4755b0d1848483e12b
SHA512 a15ca3dfb14ce55c8b56030444002c989d4c6858a0adc782538e442dc0eee6dd5499b4615a138c8272714a646ea39757c2a462a8ae7f0f6af729a2be81178507
SSDEEP 24576:aUqa71YB5DHlommmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm7:aF15K
MD5 SHA1 SHA512 SSDEEP

Submit Download

ojyinski.exe

Path C:\Windows\SysWOW64\qlrgkqom\ojyinski.exe
Size 92KB
SHA256 1ca2743d033fc40c55d44424a2ca5dba099a7bdaf1f7b10b78dd7c52444186d8
MD5 0d8078efffddb9ef433100f9782935a4
SHA1 9337f94c68ecd212435fcc6e1a8b8097af4ce5f1
SHA512 7a9a4ad76abb43458e9e24fa37742be0b8b0760e29ddd07dcb48385baa4972f9e37513f927f45ae8df1d88a756da8ecb815e66baefe3113ced4d669c77d673cf
SSDEEP 1536:a3CiBR5GqBozhvOayckOfkw/KxwDOHuQfC0BY+IGepCuv2Adf9/GktYS:a3CsRAEoxpywfd/KSDOHuwC0BY374pAd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/768-21-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/768-20-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/768-22-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/768-10-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/768-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/768-15-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/768-19-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/1576-9-0x0000000000220000-0x0000000000233000-memory.dmp

Download

memory/1576-2-0x0000000000220000-0x0000000000233000-memory.dmp

Download

memory/1576-1-0x00000000005B0000-0x00000000006B0000-memory.dmp

Download

memory/1576-8-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1576-3-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/2584-17-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/2584-13-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/2584-11-0x00000000005B0000-0x00000000006B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads